ID. Date of interview 
date 40/92/20 


ID. Time interview started 
start 44:00:09 


ID.end Completion date of interview 
Date = 40/02/20 


ID.end Time interview ended 
14:42:41 


ID. Duration of interview 
time 42.53 


new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
) Yes 


© No 
C) Unsure / don't know 
If no or unsure/don’t know, what other issues would you like to be covered in it? 


Issues not covered or require clarification include: - Whether/when draft documents should be included 
in SAR returns - Whether entirely redacted pages should always be printed out and sent to requesters - 
Whether internal correspondence relating to processing of SAR returns themselves or complaints relating 
to SAR handling should be disclosed on receipt of subsequent requests - More clarification on when data 
held is considered to be 'about' the individual and where information that includes data subject's names 
but isn't 'about' them can be excluded - More clarity on complaint escalation - whilst organisations try to 
resolve issues without recourse to the ICO, data subjects have a right to contact the ICO with their 
concerns (which is outlined in the guidance). ICO case officers are contacting organisations to ask them 
not to involve the ICO where possible. - More clarity on when organisations can deal with requests in the 
course of normal business rather than treating them as formal SARs - We often get requests for 
‘everything the organisation holds about me' and on asking for clarification, get no further information 
from the requester - in a large and disparate organisation this is sometimes near impossible - can these 
be treated as complex?, can the organisation take a pragmatic approach and just check key personal 
data repositories rather than making enquiries with hundreds of services to see if the requester is known 
to them? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don't know, please provide any examples that think should be included in 
the draft guidance. 


Examples of where the different types of Legal Professional Privelege are applicable and clarity on the 
use of the exemption over time. We would welcome relevant examples of the social work data exemption 
and in particular the expected workflow in carrying out the ‘serious harm test’. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 
requests below (if applicable). 


We sometimes get SAR requests for data held that relate to the processing of SARs 
themselves. We sometimes get repeat SARs covering the same or similar time 
periods. We sometimes get SAR requests seemingly motivated purely for the 
purpose of disrupting daily business/time wasting - it would be good to align 


organisational 'unreasonable behaviour policy' with the 'manifestly unfounded' 
exemption 


Q5 


Q6 


Q7 


On a scale of 1-5 how useful is the draft guidance? 


3 ee: 
1-Notatall 2-—Slightly | Moderately 4-Very 5-Extremely 
useful useful useful useful useful 


O C) O D O 
Why have you given this score? 


The guidance helps clarify current practice in the event of scrutiny. It will be of even 
more use if those areas identified, currently not included, are addressed. 


To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


O © O 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


We have always found the 3 step process very useful and a good workflow to follow 
- however we would welcome if it could be improved to be more flexible in its use 
such as the production of a flow chart or template form. Information sharing and 
integrated working across the public sector and now the third sector is one of the 
most challenging and fastest growing areas of information governance - in particular 
we would find it most helpful if the ICO could have inserted a section on third party 
reports and the rights of access - particularly in relation to the adults and children’s 
social care sectors. We would very much to like to see the inclusion of third party 
data as a separate section on professional reports. 


Are you answering as: 


C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

€ ) Other 

Please specify the name of your organisation: 

Multiple Local Authorities 


What sector are you from: 


public 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(_ ) ICO Facebook account 
(_) ICO LinkedIn account 
C) ICO website 
©) ICO newsletter 
( ) ICO staff member 
(_) Colleague 
(_) Personal/work Twitter account 
(_) Personal/work Facebook account 
(_) Personal/work LinkedIn account 
(_) Other 
If other please specify: 


